story-setup

SUSPICIOUS: the skill's behavior largely matches its stated purpose as a multi-platform writing-environment deployer, and there is no clear credential harvesting or exfiltration path. However, it has a broad write/execute footprint, modifies hooks and git behavior, and relies on a same-repo GitHub Release zip plus `npx skills add` reinstall instructions, which creates meaningful supply-chain and transitive-trust risk.

This JSON is a high-impact hook dispatcher that repeatedly executes a local Node.js script from a non-standard hidden directory during session/tool lifecycle events. The fragment contains no overt malicious code or obfuscation itself, but it creates multiple privileged command-execution entry points. Security depends almost entirely on the contents and integrity of `.trae/hooks/story_trae_hook.js`; review that script for filesystem/process manipulation and any network/credential access. Treat as suspicious until the referenced script is verified and controlled.

This module is a lifecycle hook runner that resolves a project root (from env/CWD), locates `.codex/hooks/run-story-hook.sh` (Unix) or `.codex/hooks/run-story-hook.cmd` (Windows), and executes it with the specified event. The snippet shows no explicit data theft or network activity, but it contains a high-impact arbitrary-code-execution pathway driven by repository-local hook content and uses `powershell -ExecutionPolicy Bypass` on Windows, increasing risk if the `.codex/hooks` files can be tampered with.

This fragment is not itself malicious code, but it is a powerful hook dispatcher that repeatedly executes multiple local bash scripts from a hidden project directory (".claude/hooks") based on workflow events. The security risk is primarily contingent on the integrity and provenance of the referenced scripts and the runtime value of "$CLAUDE_PROJECT_DIR". Inspect and verify all .claude/hooks/*.sh contents (and ensure $CLAUDE_PROJECT_DIR cannot be influenced by an attacker).